Mora_001

Mora_001 is a threat actor exhibiting a distinct operational signature that combines opportunistic attacks with ties to the LockBit ecosystem. The actor has been observed exploiting CVE-2024-55591 and CVE-2025-24472 vulnerabilities affecting Fortinet devices. The ransom note associated with Mora_001 includes the same TOX ID used by LockBit, indicating a potential affiliation or shared communication channels. Their post-exploitation patterns suggest a structured playbook that differentiates them from other ransomware operators, including LockBit affiliates.

The group's reported origin is Russia.

Published reports on this actor:

• https://www.forescout.com/blog/new-ransomware-operator-exploits-fortinet-vulnerability-duo/

Source: MISP Galaxy, Malpedia.